hanna/fabrica

feat(store): group settings, collaborators, and recursive GC

fc737e6 · hanna committed on 2026-07-26

Add a `manual` flag and `visibility` to groups plus a `group_collaborators`
table (migration 0021). Manual groups are created explicitly and never
collected; auto groups created to hold a repo are garbage-collected up the
tree by `delete_repo` once their last repo and child leave.

Group collaborators cascade to every repo in the subtree: `effective_permission`
maxes a repo's direct collaborator row against any ancestor group grant, and
`effective_group_permission` resolves the same for a group itself. `rename_group`
rewrites the materialized paths of the group, its descendant groups, and every
repo beneath it in one transaction.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/model/src/entity.rs +5 −0

crates/store/src/groups.rs +397 −32

crates/store/src/repos.rs +7 −1

crates/store/src/tests.rs +224 −0

migrations/postgres/0021_group_settings.sql +14 −0

migrations/sqlite/0021_group_settings.sql +14 −0

     pub path: String,
     /// Optional description.
     pub description: Option<String>,
+    /// Whether the group was created explicitly (persists) rather than
+    /// auto-created to hold a repo (garbage-collected when empty).
+    pub manual: bool,
+    /// The group's visibility (gates its listing page).
+    pub visibility: Visibility,
     /// Creation time.
     pub created_at: Timestamp,
+}

     /// Delete a repository row (cascading to collaborators). The caller is
     /// responsible for the on-disk directory — moving it to trash, or purging it.
-    /// Returns `true` if a row was removed.
+    /// Returns `true` if a row was removed. Empty auto-created groups the repo
+    /// left behind are garbage-collected up the tree.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn delete_repo(&self, repo_id: &str) -> Result<bool, StoreError> {
+        // Remember the group before the row disappears, to garbage-collect it.
+        let group_id = self.repo_by_id(repo_id).await?.and_then(|r| r.group_id);
         let deleted = sqlx::query("DELETE FROM repos WHERE id = $1")
             .bind(repo_id)
             .execute(&self.pool)
             .await?
             .rows_affected();
+        if deleted > 0 {
+            self.gc_empty_groups(group_id).await?;
+        }
         Ok(deleted > 0)
+    }

+-- Groups gain their own settings: a manual flag (manual groups persist; auto
+-- groups are garbage-collected when empty), a visibility, and collaborators
+-- whose access cascades to every repository in the group's subtree.
+ALTER TABLE groups ADD COLUMN manual BOOLEAN NOT NULL DEFAULT FALSE;
+ALTER TABLE groups ADD COLUMN visibility TEXT NOT NULL DEFAULT 'private';
+CREATE TABLE group_collaborators (
+    id         TEXT PRIMARY KEY,
+    group_id   TEXT NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
+    user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    permission TEXT NOT NULL,
+    created_at BIGINT NOT NULL
+);
+CREATE UNIQUE INDEX idx_group_collab ON group_collaborators (group_id, user_id);

+-- Groups gain their own settings: a manual flag (manual groups persist; auto
+-- groups are garbage-collected when empty), a visibility, and collaborators
+-- whose access cascades to every repository in the group's subtree.
+ALTER TABLE groups ADD COLUMN manual INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE groups ADD COLUMN visibility TEXT NOT NULL DEFAULT 'private';
+CREATE TABLE group_collaborators (
+    id         TEXT PRIMARY KEY,
+    group_id   TEXT NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
+    user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    permission TEXT NOT NULL,
+    created_at BIGINT NOT NULL
+);
+CREATE UNIQUE INDEX idx_group_collab ON group_collaborators (group_id, user_id);

 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-//! Groups: the nested, user-owned repository hierarchy.
+//! Groups: the nested, user-owned repository hierarchy, with per-group settings
+//! (visibility, collaborators) and recursive garbage collection of the auto-
+//! created groups that once held a now-deleted repository.
-use model::Group;
+use model::{Group, Visibility};
 use sqlx::any::AnyRow;
 use sqlx::{AssertSqlSafe, Row};
+use crate::repos::Collaborator;
 use crate::{Store, StoreError, map_conflict, new_id, now_ms};
 /// The columns of `groups` in a fixed order, shared by every `SELECT`.
-const GROUP_COLUMNS: &str = "id, owner_id, parent_id, name, path, description, created_at";
+const GROUP_COLUMNS: &str =
+    "id, owner_id, parent_id, name, path, description, manual, visibility, created_at";
+/// Rank a permission token so the highest across repo + group collaborators wins.
+fn perm_rank(perm: &str) -> i32 {
+    match perm {
+        "admin" => 3,
+        "write" => 2,
+        "read" => 1,
+        _ => 0,
+    }
+}
 impl Store {
     /// Ensure a group exists at `owner_id`/`path`, creating it and every missing
-    /// intermediate group, and return the leaf group. Existing groups along the
+    /// intermediate group (all auto), and return the leaf group.
-    /// path are reused. Each segment name is validated.
-    ///
-    /// This powers both `fabrica group add` and the `repo add owner group/sub/repo`
-    /// convenience that auto-creates the groups a repo is filed under.
     ///
     /// # Errors
     ///
     /// * [`StoreError::Name`] if any segment is an invalid name.
+    /// * [`StoreError::GroupTooDeep`] past [`model::MAX_GROUP_DEPTH`].
     /// * [`StoreError::Query`] on a database failure.
     pub async fn ensure_group_path(&self, owner_id: &str, path: &str) -> Result<Group, StoreError> {
         let segments: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
             parent_id = Some(group.id.clone());
             leaf = Some(group);
+        }
-        // `leaf` is always set: `segments` was non-empty.
         leaf.ok_or(StoreError::Name(model::NameError::Empty))
+    }
-    /// Insert a single group row.
+    /// Create a group explicitly at `path`, marking its leaf as manual so it is
+    /// never garbage-collected. Intermediates are created auto.
+    ///
+    /// # Errors
+    ///
+    /// See [`Store::ensure_group_path`].
+    pub async fn create_group(&self, owner_id: &str, path: &str) -> Result<Group, StoreError> {
+        let leaf = self.ensure_group_path(owner_id, path).await?;
+        sqlx::query("UPDATE groups SET manual = $1 WHERE id = $2")
+            .bind(true)
+            .bind(&leaf.id)
+            .execute(&self.pool)
+            .await?;
+        self.group_by_id(&leaf.id)
+            .await?
+            .ok_or(StoreError::Name(model::NameError::Empty))
+    }
+    /// Insert a single (auto) group row.
     async fn insert_group(
         &self,
         owner_id: &str,
             name: name.to_string(),
             path: path.to_string(),
             description: None,
+            manual: false,
+            visibility: Visibility::Private,
             created_at: now_ms(),
         };
-        let sql = "INSERT INTO groups (id, owner_id, parent_id, name, path, description, created_at) \
+        let sql = "INSERT INTO groups \
-             VALUES ($1, $2, $3, $4, $5, $6, $7)";
+             (id, owner_id, parent_id, name, path, description, manual, visibility, created_at) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)";
         sqlx::query(sql)
             .bind(group.id.clone())
             .bind(group.owner_id.clone())
             .bind(group.name.clone())
             .bind(group.path.clone())
             .bind(group.description.clone())
+            .bind(group.manual)
+            .bind(group.visibility.as_str())
             .bind(group.created_at)
             .execute(&self.pool)
             .await
         Ok(group)
+    }
-    /// Resolve a group by `(owner_id, path)`, or `None` if absent.
+    /// Resolve a group by `(owner_id, path)`, or `None`.
     ///
     /// # Errors
     ///
             .bind(path)
             .fetch_optional(&self.pool)
             .await?;
-        Ok(row.as_ref().map(map_group).transpose()?)
+        Ok(row.as_ref().map(|r| self.map_group(r)).transpose()?)
+    }
+    /// Fetch a group by id.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn group_by_id(&self, id: &str) -> Result<Option<Group>, StoreError> {
+        let sql = format!("SELECT {GROUP_COLUMNS} FROM groups WHERE id = $1");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(id)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(|r| self.map_group(r)).transpose()?)
+    }
     /// List every group owned by `owner_id`, ordered by path.
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
-            .map(map_group)
+            .map(|r| self.map_group(r))
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
-            .map(map_group)
+            .map(|r| self.map_group(r))
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
-            .map(map_group)
+            .map(|r| self.map_group(r))
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
-    /// Delete a group by id. Child groups cascade (`ON DELETE CASCADE`); repos in
+    /// Set a group's visibility.
-    /// the group have their `group_id` set null by the schema, so they survive as
+    ///
-    /// ungrouped repos. Returns `true` if a row was deleted.
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_group_visibility(
+        &self,
+        group_id: &str,
+        visibility: Visibility,
+    ) -> Result<(), StoreError> {
+        sqlx::query("UPDATE groups SET visibility = $1 WHERE id = $2")
+            .bind(visibility.as_str())
+            .bind(group_id)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+    /// Rename a group's leaf name, updating the materialized paths of the group,
+    /// its descendant groups, and every repository beneath it.
+    ///
+    /// # Errors
+    ///
+    /// * [`StoreError::Name`] if `new_name` is invalid.
+    /// * [`StoreError::Conflict`] if the new path is already taken.
+    /// * [`StoreError::Query`] for any other database failure.
+    pub async fn rename_group(&self, group_id: &str, new_name: &str) -> Result<Group, StoreError> {
+        model::validate_name(new_name)?;
+        let group = self
+            .group_by_id(group_id)
+            .await?
+            .ok_or(StoreError::Name(model::NameError::Empty))?;
+        let old_path = group.path.clone();
+        let new_path = match old_path.rsplit_once('/') {
+            Some((prefix, _)) => format!("{prefix}/{new_name}"),
+            None => new_name.to_string(),
+        };
+        if new_path != old_path
+            && (self
+                .group_by_owner_path(&group.owner_id, &new_path)
+                .await?
+                .is_some()
+                || self
+                    .repo_by_owner_path(&group.owner_id, &new_path)
+                    .await?
+                    .is_some())
+        {
+            return Err(StoreError::Conflict {
+                entity: "group",
+                field: "path",
+            });
+        }
+        let old_prefix = format!("{old_path}/%");
+        let old_len = i64::try_from(old_path.len()).unwrap_or(i64::MAX);
+        let mut tx = self.pool.begin().await?;
+        // Descendant groups: replace the shared path prefix.
+        sqlx::query(
+            "UPDATE groups SET path = $1 || SUBSTR(path, $2) \
+             WHERE owner_id = $3 AND path LIKE $4",
+        )
+        .bind(&new_path)
+        .bind(old_len + 1)
+        .bind(&group.owner_id)
+        .bind(&old_prefix)
+        .execute(&mut *tx)
+        .await?;
+        // Repositories beneath the group.
+        sqlx::query(
+            "UPDATE repos SET path = $1 || SUBSTR(path, $2) \
+             WHERE owner_id = $3 AND path LIKE $4",
+        )
+        .bind(&new_path)
+        .bind(old_len + 1)
+        .bind(&group.owner_id)
+        .bind(&old_prefix)
+        .execute(&mut *tx)
+        .await?;
+        // The group itself.
+        sqlx::query("UPDATE groups SET name = $1, path = $2 WHERE id = $3")
+            .bind(new_name)
+            .bind(&new_path)
+            .bind(group_id)
+            .execute(&mut *tx)
+            .await?;
+        tx.commit().await?;
+        self.group_by_id(group_id)
+            .await?
+            .ok_or(StoreError::Name(model::NameError::Empty))
+    }
+    /// Whether a group holds any repositories directly.
+    async fn group_has_repos(&self, group_id: &str) -> Result<bool, StoreError> {
+        let row = sqlx::query("SELECT 1 AS n FROM repos WHERE group_id = $1")
+            .bind(group_id)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.is_some())
+    }
+    /// Whether a group has any child groups.
+    async fn group_has_children(&self, group_id: &str) -> Result<bool, StoreError> {
+        let row = sqlx::query("SELECT 1 AS n FROM groups WHERE parent_id = $1")
+            .bind(group_id)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.is_some())
+    }
+    /// The number of repositories anywhere in a group's subtree.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn group_subtree_repo_count(&self, group: &Group) -> Result<i64, StoreError> {
+        let prefix = format!("{}/%", group.path);
+        let n: i64 =
+            sqlx::query("SELECT COUNT(*) AS n FROM repos WHERE owner_id = $1 AND path LIKE $2")
+                .bind(&group.owner_id)
+                .bind(&prefix)
+                .fetch_one(&self.pool)
+                .await?
+                .try_get("n")?;
+        Ok(n)
+    }
+    /// Garbage-collect empty auto groups upward from `group_id`: while a group is
+    /// auto (not manual) and holds no repos and no child groups, delete it and
+    /// continue with its parent. Manual groups (and non-empty ones) stop the walk.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn gc_empty_groups(&self, mut group_id: Option<String>) -> Result<(), StoreError> {
+        let mut guard = 0;
+        while let Some(gid) = group_id {
+            guard += 1;
+            if guard > 64 {
+                break;
+            }
+            let Some(group) = self.group_by_id(&gid).await? else {
+                break;
+            };
+            if group.manual
+                || self.group_has_repos(&gid).await?
+                || self.group_has_children(&gid).await?
+            {
+                break;
+            }
+            let parent = group.parent_id.clone();
+            self.delete_group(&gid).await?;
+            group_id = parent;
+        }
+        Ok(())
+    }
+    /// Delete a group by id. Child groups cascade; repos have their `group_id`
+    /// set null by the schema. Returns `true` if a row was deleted.
     ///
     /// # Errors
     ///
             .rows_affected();
         Ok(deleted > 0)
+    }
-}
-/// Map a `groups` row (selected via [`GROUP_COLUMNS`]) to a [`Group`].
+    // ---- Group collaborators ----
-fn map_group(row: &AnyRow) -> Result<Group, sqlx::Error> {
-    Ok(Group {
+    /// Add or update a group collaborator's permission.
-        id: row.try_get("id")?,
+    ///
-        owner_id: row.try_get("owner_id")?,
+    /// # Errors
-        parent_id: row.try_get("parent_id")?,
+    ///
-        name: row.try_get("name")?,
+    /// Returns [`StoreError::Query`] on a database failure.
-        path: row.try_get("path")?,
+    pub async fn add_group_collaborator(
-        description: row.try_get("description")?,
+        &self,
-        created_at: row.try_get("created_at")?,
+        group_id: &str,
-    })
+        user_id: &str,
+        permission: &str,
+    ) -> Result<(), StoreError> {
+        sqlx::query(
+            "INSERT INTO group_collaborators (id, group_id, user_id, permission, created_at) \
+             VALUES ($1, $2, $3, $4, $5) \
+             ON CONFLICT (group_id, user_id) DO UPDATE SET permission = $4",
+        )
+        .bind(new_id())
+        .bind(group_id)
+        .bind(user_id)
+        .bind(permission)
+        .bind(now_ms())
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+    /// Remove a group collaborator.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn remove_group_collaborator(
+        &self,
+        group_id: &str,
+        user_id: &str,
+    ) -> Result<(), StoreError> {
+        sqlx::query("DELETE FROM group_collaborators WHERE group_id = $1 AND user_id = $2")
+            .bind(group_id)
+            .bind(user_id)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+    /// List a group's collaborators with their usernames resolved.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn list_group_collaborators(
+        &self,
+        group_id: &str,
+    ) -> Result<Vec<Collaborator>, StoreError> {
+        let rows = sqlx::query(
+            "SELECT gc.user_id, u.username, gc.permission \
+             FROM group_collaborators gc JOIN users u ON u.id = gc.user_id \
+             WHERE gc.group_id = $1 ORDER BY u.username_lower ASC",
+        )
+        .bind(group_id)
+        .fetch_all(&self.pool)
+        .await?;
+        rows.iter()
+            .map(|r| {
+                Ok(Collaborator {
+                    user_id: r.try_get("user_id")?,
+                    username: r.try_get("username")?,
+                    permission: r.try_get("permission")?,
+                })
+            })
+            .collect::<Result<_, sqlx::Error>>()
+            .map_err(Into::into)
+    }
+    /// A user's collaborator permission on a group, if any.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn group_collaborator_permission(
+        &self,
+        group_id: &str,
+        user_id: &str,
+    ) -> Result<Option<String>, StoreError> {
+        let row = sqlx::query(
+            "SELECT permission FROM group_collaborators WHERE group_id = $1 AND user_id = $2",
+        )
+        .bind(group_id)
+        .bind(user_id)
+        .fetch_optional(&self.pool)
+        .await?;
+        Ok(row.map(|r| r.try_get("permission")).transpose()?)
+    }
+    /// A user's effective collaborator permission on a repo: the strongest of its
+    /// direct collaborator row and any group-collaborator row on the repo's group
+    /// or an ancestor group.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn effective_permission(
+        &self,
+        repo_id: &str,
+        user_id: &str,
+    ) -> Result<Option<String>, StoreError> {
+        let mut best: Option<String> = self.collaborator_permission(repo_id, user_id).await?;
+        let mut best_rank = best.as_deref().map_or(0, perm_rank);
+        let mut group_id = self.repo_by_id(repo_id).await?.and_then(|r| r.group_id);
+        let mut guard = 0;
+        while let Some(gid) = group_id {
+            guard += 1;
+            if guard > 64 {
+                break;
+            }
+            if let Some(p) = self.group_collaborator_permission(&gid, user_id).await? {
+                let r = perm_rank(&p);
+                if r > best_rank {
+                    best_rank = r;
+                    best = Some(p);
+                }
+            }
+            group_id = self.group_by_id(&gid).await?.and_then(|g| g.parent_id);
+        }
+        Ok(best)
+    }
+    /// A user's effective collaborator permission on a group: the strongest
+    /// group-collaborator row on the group itself or any ancestor group.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn effective_group_permission(
+        &self,
+        group_id: &str,
+        user_id: &str,
+    ) -> Result<Option<String>, StoreError> {
+        let mut best: Option<String> = None;
+        let mut best_rank = 0;
+        let mut next = Some(group_id.to_string());
+        let mut guard = 0;
+        while let Some(gid) = next {
+            guard += 1;
+            if guard > 64 {
+                break;
+            }
+            if let Some(p) = self.group_collaborator_permission(&gid, user_id).await? {
+                let r = perm_rank(&p);
+                if r > best_rank {
+                    best_rank = r;
+                    best = Some(p);
+                }
+            }
+            next = self.group_by_id(&gid).await?.and_then(|g| g.parent_id);
+        }
+        Ok(best)
+    }
+    /// Map a `groups` row (selected via [`GROUP_COLUMNS`]) to a [`Group`].
+    fn map_group(&self, row: &AnyRow) -> Result<Group, sqlx::Error> {
+        Ok(Group {
+            id: row.try_get("id")?,
+            owner_id: row.try_get("owner_id")?,
+            parent_id: row.try_get("parent_id")?,
+            name: row.try_get("name")?,
+            path: row.try_get("path")?,
+            description: row.try_get("description")?,
+            manual: self.get_bool(row, "manual")?,
+            visibility: Visibility::from_token(&row.try_get::<String, _>("visibility")?)
+                .unwrap_or(Visibility::Private),
+            created_at: row.try_get("created_at")?,
+        })
+    }
+}

         .await
         .unwrap();
+}
+/// Helper: create a repo at `path`, auto-creating its group chain, and return it.
+async fn repo_in_group(store: &Store, owner_id: &str, path: &str) -> model::Repo {
+    let (group, leaf) = match path.rsplit_once('/') {
+        Some((g, l)) => (Some(g), l),
+        None => (None, path),
+    };
+    let group_id = match group {
+        Some(g) => Some(store.ensure_group_path(owner_id, g).await.unwrap().id),
+        None => None,
+    };
+    store
+        .create_repo(NewRepo {
+            owner_id: owner_id.to_string(),
+            group_id,
+            name: leaf.to_string(),
+            path: path.to_string(),
+            description: None,
+            visibility: model::Visibility::Private,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap()
+}
+#[tokio::test]
+async fn deleting_last_repo_gcs_empty_auto_groups() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("gc", "gc@example.com"))
+            .await
+            .unwrap();
+        // what/the/fuck where `fuck` is a repo; siblings keep their branch alive.
+        let repo = repo_in_group(&fx.store, &owner.id, "what/the/fuck").await;
+        let sibling = repo_in_group(&fx.store, &owner.id, "what/keep").await;
+        assert!(
+            fx.store
+                .group_by_owner_path(&owner.id, "what/the")
+                .await
+                .unwrap()
+                .is_some()
+        );
+        // Deleting `fuck` empties `the` (deleted), but `what` still holds `keep`.
+        assert!(fx.store.delete_repo(&repo.id).await.unwrap());
+        assert!(
+            fx.store
+                .group_by_owner_path(&owner.id, "what/the")
+                .await
+                .unwrap()
+                .is_none(),
+            "empty auto group `what/the` should be collected"
+        );
+        assert!(
+            fx.store
+                .group_by_owner_path(&owner.id, "what")
+                .await
+                .unwrap()
+                .is_some(),
+            "`what` still holds the `keep` repo"
+        );
+        // Removing the last repo collects the whole chain up to the root.
+        assert!(fx.store.delete_repo(&sibling.id).await.unwrap());
+        assert!(
+            fx.store
+                .group_by_owner_path(&owner.id, "what")
+                .await
+                .unwrap()
+                .is_none(),
+            "the now-empty root auto group is collected too"
+        );
+    }
+}
+#[tokio::test]
+async fn manual_groups_survive_gc() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("man", "man@example.com"))
+            .await
+            .unwrap();
+        // Manually create `team`, then a repo under an auto subgroup.
+        let team = fx.store.create_group(&owner.id, "team").await.unwrap();
+        assert!(team.manual);
+        let repo = repo_in_group(&fx.store, &owner.id, "team/auto/proj").await;
+        assert!(fx.store.delete_repo(&repo.id).await.unwrap());
+        assert!(
+            fx.store
+                .group_by_owner_path(&owner.id, "team/auto")
+                .await
+                .unwrap()
+                .is_none(),
+            "auto subgroup collected"
+        );
+        assert!(
+            fx.store
+                .group_by_owner_path(&owner.id, "team")
+                .await
+                .unwrap()
+                .is_some(),
+            "manual group is never collected"
+        );
+    }
+}
+#[tokio::test]
+async fn group_collaborator_grants_effective_permission() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("own", "own@example.com"))
+            .await
+            .unwrap();
+        let collab = fx
+            .store
+            .create_user(sample_user("col", "col@example.com"))
+            .await
+            .unwrap();
+        let repo = repo_in_group(&fx.store, &owner.id, "acme/deep/svc").await;
+        // No access before any grant.
+        assert!(
+            fx.store
+                .effective_permission(&repo.id, &collab.id)
+                .await
+                .unwrap()
+                .is_none()
+        );
+        // Grant write on the top group; it cascades down to the nested repo.
+        let acme = fx
+            .store
+            .group_by_owner_path(&owner.id, "acme")
+            .await
+            .unwrap()
+            .unwrap();
+        fx.store
+            .add_group_collaborator(&acme.id, &collab.id, "write")
+            .await
+            .unwrap();
+        assert_eq!(
+            fx.store
+                .effective_permission(&repo.id, &collab.id)
+                .await
+                .unwrap()
+                .as_deref(),
+            Some("write")
+        );
+        // A stronger repo-level grant wins over the weaker group grant.
+        fx.store
+            .set_collaborator(&repo.id, &collab.id, "admin")
+            .await
+            .unwrap();
+        assert_eq!(
+            fx.store
+                .effective_permission(&repo.id, &collab.id)
+                .await
+                .unwrap()
+                .as_deref(),
+            Some("admin")
+        );
+        // The group-level effective permission also resolves for the group itself.
+        let svc_group = fx
+            .store
+            .group_by_owner_path(&owner.id, "acme/deep")
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            fx.store
+                .effective_group_permission(&svc_group.id, &collab.id)
+                .await
+                .unwrap()
+                .as_deref(),
+            Some("write"),
+            "ancestor group grant is inherited"
+        );
+    }
+}
+#[tokio::test]
+async fn rename_group_moves_subtree() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("rn", "rn@example.com"))
+            .await
+            .unwrap();
+        let repo = repo_in_group(&fx.store, &owner.id, "old/sub/proj").await;
+        let top = fx
+            .store
+            .group_by_owner_path(&owner.id, "old")
+            .await
+            .unwrap()
+            .unwrap();
+        fx.store.rename_group(&top.id, "new").await.unwrap();
+        // The repo and descendant group paths are rewritten under the new prefix.
+        let moved = fx.store.repo_by_id(&repo.id).await.unwrap().unwrap();
+        assert_eq!(moved.path, "new/sub/proj");
+        assert!(
+            fx.store
+                .group_by_owner_path(&owner.id, "new/sub")
+                .await
+                .unwrap()
+                .is_some()
+        );
+        assert!(
+            fx.store
+                .group_by_owner_path(&owner.id, "old/sub")
+                .await
+                .unwrap()
+                .is_none()
+        );
+    }
+}